TLDR INFORMATION SECURITY 2025-05-22

DDOSECRETS PUBLISHES 410 GB OF HEAP DUMPS, HACKED FROM TELEMESSAGE'S ARCHIVE SERVER

Distributed Denial of Secrets published 410 GB of data that it stole from TeleMessage, an Israeli firm that makes modified versions of chat apps such as Signal and centrally archives messages. Some heap dumps include plaintext metadata, while others only include metadata, including sender and recipient information, timestamps, and group names. Due to the sensitive nature and PII in the messages, DDoSecrets only shared the data with journalists and researchers.

VANHELSING RANSOMWARE BUILDER LEAKED ON HACKING FORUM

After a former developer for the Ransomware-as-a-Service operator VanHelsing attempted to sell the source code for the VanHelsing affiliate panel, data leak Tor sites, and builders for the Windows and Linux encryptors, VanHelsing proactively released the source code itself. The leaked source code includes the Windows encryptor, which will require modifications for other threat actors, and the source code for the affiliate panel and blog site, which can be run as is. The data VanHelsing leaked was only a subset of what the former developer attempted to sell, as it did not include any databases or the Linux builder.

COINBASE SAYS ITS DATA BREACH AFFECTS AT LEAST 69,000 CUSTOMERS

Coinbase reported that 69,461 customers had personal and financial data stolen during a six-month breach. Hackers bribed support staff, stealing names, addresses, ID documents, account balances, and transaction histories. Despite a $20 million ransom demand, Coinbase refused to pay.

WHY RECREATING AN IAM ROLE DOESN'T RESTORE TRUST: A GOTCHA IN ROLE ARNS

In AWS IAM, trust policies reference ARNs in their JSON but reference an underlying, immutable principal ID, so if a role is deleted and recreated, the trust policy will also need to be recreated, even if the ARN is unchanged. This provides a security benefit in that if a role is deleted but the trust policy is unintentionally not updated, the role cannot be stealthily recreated and assume the same level of trust. Users can get around this issue by using a complete account as the principal in a trust policy with a condition block that restricts access to the specific role ARN.

FORGET IPS: USING CRYPTOGRAPHY TO VERIFY BOT AND AGENT TRAFFIC

In the era of AI agents, not all bot traffic is malicious. Cloudflare proposed two mechanisms for “good bots” to self-identify. The first is HTTP Message Signatures, which adds a Signature-Input header with a signature, validity period, usage tag, and a Signature-Agent header to locate the key. The second option is a new TLS flag, req_mTLS, which allows clients to indicate support for mutual TLS and identify the bot.

SECURING CI/CD WORKFLOWS WITH WAZUH

CI/CD pipelines automate software development but introduce security risks like supply chain attacks and misconfigurations. Wazuh, an open-source security platform, enhances CI/CD security through log collection, file integrity monitoring, custom security rules, and more. This post dives into how to use it.

OKTA SECURITY DETECTION CATALOG

A collection of detection rules for security monitoring with detailed descriptions of log fields used for threat analysis within Okta environments.

WPAUDIT

WPAUDIT is a hyper-configurable, modular WordPress security auditing suite engineered to automate and streamline identifying vulnerabilities and security weaknesses in WordPress installations.

POCKET ID

Pocket ID is a simple OIDC provider that allows users to authenticate services with their passkeys.

SECURITY IS A NEGOTIATION PROBLEM

This post reflects on budgeting issues with security products and shares an experience with negotiating vendors down to under 10% of initial quotes. It recommends using Google Ads to uncover competitor concerns and obtain competing quotes while downplaying the proposed solution's value. The post also highlights tactics like applying pressure and providing the sales rep with the hope of a purchase.

M&S WARNS OF £300M DENT IN PROFITS FROM CYBERATTACK

Marks & Spencer expects a £300 million hit to next year's profits from its ongoing cyberattack, partially offset by insurance and cost mitigation. The month-long breach will force online sales offline until July, impacting food availability and operations.

CELLCOM SERVICE DISRUPTION CAUSED BY CYBERATTACK

GOOGLE CHROME WILL BE ABLE TO AUTOMATICALLY CHANGE YOUR BAD PASSWORDS

With user consent, Chrome will soon automatically change weak passwords, helping improve security on supported websites without requiring manual updates.

MICROSOFT DISMANTLES LUMMA STEALER NETWORK, SEIZES 2,000+ DOMAINS

Microsoft and global law enforcement dismantled Lumma Stealer, a significant malware, by seizing over 2,300 web domains to prevent it from accessing infected devices.

RUSSIA TO ENFORCE LOCATION TRACKING APP ON ALL FOREIGNERS IN MOSCOW

Russia intends to require foreign residents in Moscow to install a tracking app on their phones to gather data such as location, fingerprints, and facial images.